calculate percentage

[dhs_harry08]

Hi,

I have a requirement wherein I am using bucket to calculate range and their values.

host="hobbes8" |search success OR fail|eventstats count(txnId) as gtotal |bucket api_time bins=100|eventstats count(txnId) as total by api_time|eval percent=100*total/gtotal |table api_time,percent,total.

I am getting my result but im getting many dupliicate entries. An when I am using stats I am getting the error. api_time should be numerical. Can you help me with this.
I need the result like this.

api_time    percent        total

1 1500-1600 0.277316 10
2 400-500 6.211869 224
3 800-900 2.329451 84
4 300-400 6.267332 226

Regards,
Harish

[dhs_harry08]

Thankq that helped and worked.

Regards,
Harish

[acdevlin · Accepted solution]

Stats does have the ability to print non-numerical values; I'm not sure why it would complain about them, unless there was a syntax error somewhere in your query . Try the following instead of the pipe to "table" to display your results:

... | stats values(percent) AS "Percent", values(total) AS "Total" by api_time

If you still get duplicate values, you might want to look into the "dedup" command: http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Dedup

[dhs_harry08]

api_time percent total

1500-1600 0.277316 10

400-500 6.211869 224

800-900 2.329451 84

300-400 6.267332 226